Conectar un negocio

Tu web ──▶ https://www.craqui.com/oauth/authorize?…        el propietario elige negocio y permisos
       ◀── https://app.example.com/craqui/callback?code=…&state=…&iss=https://api.craqui.com
Tu servidor ──POST https://api.craqui.com/oauth/token──▶  { access_token, refresh_token, business_id, … }
Tu servidor ──GET  https://api.craqui.com/v1/business──▶  Authorization: Bearer crq_oat_…

CODE_VERIFIER=$(openssl rand -hex 32)
CODE_CHALLENGE=$(printf '%s' "$CODE_VERIFIER" | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_' | tr -d '=')
STATE=$(openssl rand -hex 16)

https://www.craqui.com/oauth/authorize
  ?response_type=code
  &client_id=app_01jsy4wejjfcesyg3c5t6nm6sq
  &redirect_uri=https%3A%2F%2Fapp.example.com%2Fcraqui%2Fcallback
  &scope=business%3Aread%20clients%3Aread%20payments%3Aread
  &state=9f2c1e7a4b6d8f03a5c7e9b1d3f5a7c9
  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
  &code_challenge_method=S256

https://app.example.com/craqui/callback?code=6uN2yQ0rT8vX4bZ1cF5hJ7kL9mP3sW6dG8aE2iO0qRt&state=9f2c1e7a4b6d8f03a5c7e9b1d3f5a7c9&iss=https%3A%2F%2Fapi.craqui.com

https://app.example.com/craqui/callback?error=access_denied&error_description=The+user+denied+the+authorization+request&state=9f2c1e7a4b6d8f03a5c7e9b1d3f5a7c9&iss=https%3A%2F%2Fapi.craqui.com

curl -s https://api.craqui.com/oauth/token \
  -u "$CRAQUI_CLIENT_ID:$CRAQUI_CLIENT_SECRET" \
  -d grant_type=authorization_code \
  -d code="$CODE" \
  -d code_verifier="$CODE_VERIFIER" \
  --data-urlencode redirect_uri="https://app.example.com/craqui/callback"

{
  "access_token": "crq_oat_TU_ACCESS_TOKEN",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "crq_ort_TU_REFRESH_TOKEN",
  "scope": "business:read clients:read payments:read",
  "business_id": "biz_01jtm0r4w8a3b6c9d2e5f7g1hk"
}

curl -s https://api.craqui.com/v1/business \
  -H "Authorization: Bearer $CRAQUI_ACCESS_TOKEN"

{
  "id": "biz_01jtm0r4w8a3b6c9d2e5f7g1hk",
  "object": "business",
  "livemode": true,
  "name": "Estudio Marea",
  "vertical": "wellness",
  "time_zone": "America/Montevideo",
  "currency": "UYU",
  "country": "UY",
  "public_url": "https://estudiomarea.craqui.com",
  "api_version": "2026-12-01",
  "warnings": []
}

import * as oauth from 'oauth4webapi';

const as: oauth.AuthorizationServer = {
  issuer: 'https://api.craqui.com',
  authorization_endpoint: 'https://www.craqui.com/oauth/authorize',
  token_endpoint: 'https://api.craqui.com/oauth/token',
  revocation_endpoint: 'https://api.craqui.com/oauth/revoke',
  authorization_response_iss_parameter_supported: true,
};
const client: oauth.Client = { client_id: process.env.CRAQUI_CLIENT_ID! };
const clientAuth = oauth.ClientSecretBasic(process.env.CRAQUI_CLIENT_SECRET!);
const redirectUri = 'https://app.example.com/craqui/callback';

// Paso 1 y 2: «Conectar con Craqui». Devuelve la URL a la que rediriges el navegador.
export async function startConnect(session: { craqui?: { verifier: string; state: string } }): Promise<string> {
  const verifier = oauth.generateRandomCodeVerifier();
  const state = oauth.generateRandomState();
  session.craqui = { verifier, state };

  const url = new URL(as.authorization_endpoint!);
  url.searchParams.set('response_type', 'code');
  url.searchParams.set('client_id', client.client_id);
  url.searchParams.set('redirect_uri', redirectUri);
  url.searchParams.set('scope', 'business:read clients:read payments:read');
  url.searchParams.set('state', state);
  url.searchParams.set('code_challenge', await oauth.calculatePKCECodeChallenge(verifier));
  url.searchParams.set('code_challenge_method', 'S256');
  return url.href;
}

// Pasos 4 y 5: tu dirección de retorno. `callbackUrl` es la URL completa del pedido que llegó.
export async function finishConnect(session: { craqui?: { verifier: string; state: string } }, callbackUrl: URL) {
  const pending = session.craqui;
  delete session.craqui; // un intento, una vez
  if (!pending) throw new Error('No connection in progress for this session');

  // Comprueba state e iss, y lanza un error si la respuesta trae `error` (por ejemplo, access_denied).
  const params = oauth.validateAuthResponse(as, client, callbackUrl, pending.state);

  const response = await oauth.authorizationCodeGrantRequest(as, client, clientAuth, params, redirectUri, pending.verifier);
  const tokens = await oauth.processAuthorizationCodeResponse(as, client, response);

  await saveConnection({
    businessId: tokens.business_id as string,
    accessToken: tokens.access_token,
    accessExpiresAt: Date.now() + (tokens.expires_in ?? 3600) * 1000,
    refreshToken: tokens.refresh_token!,
    scopes: (tokens.scope ?? '').split(' '),
  });
}

declare function saveConnection(c: {
  businessId: string;
  accessToken: string;
  accessExpiresAt: number;
  refreshToken: string;
  scopes: string[];
}): Promise<void>;